CVE-2018-2470

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2470

SAP NetWeaver Application Server for ABAP (versions 7.0–7.02, 7.30–7.31, 7.40, and 7.50–7.53) is vulnerable to Cross-Site Scripting due to insufficient encoding of user-controlled inputs. The root cause is improper encoding in the web-facing components, enabling an attacker to inject script or HT...

CVE-2018-2470

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

SAP NetWeaver AS JAVA Cross-Site Scripting Vulnerability (CNVD-2019-09631)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

SAP NetWeaver AS Java Detection (HTTP)

HTTP based detection of SAP NetWeaver Application Server AS Java. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

SAP NetWeaver Business Intelligence XML External Entity Injection Vulnerability

SAP NetWeaver Business Intelligence is a suite of business intelligence solutions from SAP, Germany. BEx Web Java Runtime Export Web Service is one of the components of this product, which supports data warehousing, business intelligence, measurement management and information broadcasting. The B...

SAP NetWeaver WebDynpro Java Cross-Site Scripting Vulnerability

SAP Enterprise Financial Services is a set of enterprise financial services solutions from SAP. A cross-site scripting vulnerability exists in SAP NetWeaver, which arises from a failure to properly sanitize user-supplied input and can be exploited by a remote attacker to execute arbitrary script...

CVE-2018-2462

In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2462

In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source...

Design/Logic Flaw

In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2452

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

CVE-2018-2452

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

Cross site scripting

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

CVE-2018-2452

SAP NetWeaver AS Java logon application (versions 7.10–7.11, 7.20, 7.30, 7.31, 7.40, 7.50) is affected by a cross-site scripting (XSS) vulnerability caused by insufficient encoding of user-controlled inputs. The issue stems from input handling in the logon component, enabling injection of web scr...

CVE-2018-2462

In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2452

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

CVE-2018-2462

CVE-2018-2462 affects SAP NetWeaver BI (BEx Web Java Runtime Export Web Service) across versions 7.30, 7.31, 7.40, 7.41, and 7.50. The root cause is that the service does not sufficiently validate an XML document received from an untrusted source, enabling an XML External Entity Injection vulnera...

Authentication flaw

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in SAP NetWeaver 7.3 - import functionality does not perform authentication checks for valid repository user. This is an unauthenticated functionality that you can use on windows machines to do SMB relaying...

CVE-2018-2449

SAP SRM MDM Catalog in SAP NetWeaver 7.3 (versions 3.73, 7.31, 7.32) contains an authentication flaw in the import functionality that does not check credentials for a valid repository user. This creates an unauthenticated path that can be used on Windows to perform SMB relaying, effectively bypas...